fix Bug 65723

ONLYOFFICE · Jan 10, 2024 · 836d307 · 836d307
1 parent 1b233fe
commit 836d307
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/web/ASC.Web.Api/Api/ConnectionsController.cs b/web/ASC.Web.Api/Api/ConnectionsController.cs
@@ -192,8 +192,10 @@ public async Task<object> LogOutAllActiveConnectionsChangePassword()
     [HttpPut("activeconnections/logoutall/{userId}")]
     public async Task LogOutAllActiveConnectionsForUserAsync(Guid userId)
     {
-        if (!await _userManager.IsDocSpaceAdminAsync(_securityContext.CurrentAccount.ID)
-            && !await _webItemSecurity.IsProductAdministratorAsync(WebItemManager.PeopleProductID, _securityContext.CurrentAccount.ID))
+        var currentUserId = _securityContext.CurrentAccount.ID;
+        if (!await _userManager.IsDocSpaceAdminAsync(currentUserId) && 
+            !await _webItemSecurity.IsProductAdministratorAsync(WebItemManager.PeopleProductID, currentUserId) || 
+            (currentUserId != userId && await _userManager.IsDocSpaceAdminAsync(userId)))
         {
             throw new SecurityException("Method not available");
         }